Highlight:
<slangasek> ahasenack: in cosmic, libapache2-mod-shib2 is installable (though not coinstallable with other things)
<slangasek> ahasenack: in cosmic-proposed, it is not installable because apache2-bin now depends on libcurl4 where it did not previously

So apache2-bin now ships a new module called mod-mo (https://httpd.apache.org/docs/2.4/mod/mod_md.html). This module we (and debian) have been carrying in the archive as its own source. In the apache build it links with libcurl4, which is fine and good. But it does add a libcurl4 dependency to apache2-bin which wasn't there before.

Cue in libapache2-mod-shib2, from the shibboleth-sp2 source. It requires libxmltooling7, which in the archive is built with libcurl-openssl1.0-dev that is provided by a special curl3 source linked with openssl 1.0. That brings in libcurl3, which cannot be coinstalled with libcurl4. The curl package is a bit weird, because even though it's called libcurl3, it does not ship libcurl3: